12 

What is claimed is: 



1 . A method to monitor a network switch by a monitor device, said network 
switch having a plurality of regular ports and a mirror port, said mirror port being able to mirror 
network traffic for at least one of said regular ports, said network switch coupling to said monitor 
device through said mirror port, said network traffic comprising data packets forwarded between 

5 two of the plurality of regular ports, comprising: 

(1) selecting at least one of said regular ports; 

(2) mirroring a data packet of the selected port to said mirror port; 

(3) forwarding said data packet to a monitor device; 

(4) extracting the network address information of said data packet in said 
10 monitor device; 

(5) determining port information of said network address information; and 
p (6) performing network analysis of said network switch. 

2. The method to monitor a network switch according to claim 1, wherein 
fij said port information refers to physical information of said network address information in said 
%1 network switch. 

hj 3. The method to monitor a network switch according to claim 2, wherein 

jif said determining step comprising; 

O interrogating said network switch to obtain said port information using said 

^ network address information. 
5 

4. The method to monitor a network switch according to claim 3, wherein 
said interrogating step comprising: 

sending a first request to said network switch requesting a port index 
corresponding to said network address information; and 
5 sending a second request to said network switch requesting said port information 

corresponding to said port index. 
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5. The method to monitor a network switch according to claim 4, wherein 
said first request and said second request are SNMP requests. 

6. The method to monitor a network switch according to claim 1, wherein at 
least two of steps 1 to 6 perform independently and concurrently. 

7. The method to monitor a network switch according to claim 5, wherein 
said determining step comprising: 

placing said data packet in a first-in-first-out buffer waiting for responses from 
said network switch. 

5 

8. The method to monitor a network switch according to claim 7, wherein 
Q said determining step further comprising: 

releasing said data packet from said first-in-first-out buffer after said network 
# switch responds to said SNMP requests. 

m5 

zl 9. The method to monitor a network switch according to claim 7,' wherein 

3 said determining step further comprising: 

fy releasing said data packet from said first-in-first-out buffer after a predetermined 

» period of time. 

□5 

10. The method to monitor a network switch according to claim 1, further 

comprising: 

maintaining at least one lookup table correlating said network address information 
with said port information. 

5 

11. The method to monitor a network switch according to claim 1, wherein 
said network address information comprises source address of said data packet. 
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12. The method to monitor a network switch according to claim 1, wherein 
said network address information comprises destination address of said data packet. 

13. The method to monitor a network switch according to claim 1, wherein 
said network switch is a routing switch. 



a 



14. A method to monitor a network switch by a monitor device, comprising: 
(1) obtaining at least a portion of data packets being handled by said network 

switch to said monitor device, wherein each of said data packets comprises network address 

information; 

extracting, in said monitor device, said network address information of 



Q5 (2) 

fj said data packets; 

| (3) 

| (4) 

Q information. 



determining the port information of said network address information; and 
performing network analysis of said network switch using said port 



15. 



The method to monitor a network switch according to claim 14, wherein 
said port information refers to physical information of said network address information in said 
network switch. 



16. The method to monitor a network switch according to claim 15, said 
network switch having a plurality of regular ports and a mirror port, said mirror port being able 
to mirror network traffic for at least one of said regular ports, said network switch coupling to 
said monitor device through said mirror port, wherein the data packets are forwarded from said 
5 network switch to said monitor device through said mirror port. 
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17. The method to monitor a network switch according to claim 16, wherein 
said network address information of said data packets comprises source addresses. 



18. The method to monitor a network switch according to claim 16, wherein 
said network address information of said data packets comprises destination addresses. 

19. The method to monitor a network switch according to claim 16, said 
network switch comprising a plurality of regular ports, wherein said data packets are forwarded 
to said monitor device by passively tapping at least one of said regular ports. 



%J 20. The method to monitor a network switch according to claim 16, wherein 

jW said determining step comprising: 

=jf interrogating said network switch to obtain said port information using said 

y & 

□ network address information. 

L5 

[U 21. The method to monitor a network switch according to claim 20, wherein 

O said interrogating step comprising: 

i{ sending a first request to said network switch requesting a port index 

corresponding to said network address information; and 
5 sending a second request to said network switch requesting said port information 

corresponding to said port index. 

22. The method to monitor a network switch according to claim 21, wherein 
said first request and said second request are SNMP requests. 

23. The method to monitor a network switch according to claim 22, wherein 
said determining step comprising: 
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placing said data packets in a first-in-first-out buffer waiting for responses from 
said network switch. 

5 

24. The method to monitor a network switch according to claim 23, wherein 
said determining step further comprising: 

releasing said data packet from said first-in-first-out buffer after said network 
switch responds to said SNMP requests. 

5 

25. The method to monitor a network switch according to claim 23, wherein 
said determining step further comprising: 

releasing said data packet from said first-in-first-out buffer after a predetermined 

period of time. 

O 5 

26. The method to monitor a network switch according to claim 14, further 

J comprising: 

if! I 

gi maintaining at least one lookup table correlating said network address information 

s with said port information. 

: :J 

27. The method to monitor a network switch according to claim 14, wherein 
^ said network switch is a routing switch. 
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